Cybertime Hostmaster wrote:
>>Ummm- ok, Keith- why post this now?
>
>
> Actually, I found a good reason for this new regexp.
>
>
>>>The ZIP versions of the worm can be detected by matching the first line
>
> =
>
>>>of the MIME encoded attachment against one of the following regular =
>>>expressions=20
>>>
>>>'^UEsDBAoAAAAAA.{6}zy5egAlgAAAJYAA'
>>>'^UEsDBAoAAAAAA.{6}KJx\+eAFgAAABYAA'
>>>
>>
>>and Chris Scott posted this expression on 1/27 in response to your post:
>>
>>/^UEsDBAoAAAAAA/ REJECT
>
>
> This one also matched my new Secure Certificate, and bounced it.
OMG, they send you a virus! ;-)
>
> The other ones do not.
>
> So I just get to have them re-issue after making changes on my end so I
> can get the file to install.
Yep, one of the drawbacks to using body checks instead of real antivirus.
--
Chris Scott
Host Orlando, Inc.
http://www.hostorlando.com/
